CVE-2026-20854

HIGH

Windows 11 24H2/25H2 & Server 2025 < 10.0.26200.7623 - LSASS Use-After-Free RCE

Title source: llm

Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.

Core 1

Core References

Vendor Advisory vendor-advisory patch

CVSS v3 7.5

EPSS 0.0010

EPSS Percentile 27.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

CWE

CWE-416

Status published

Products (7)

Microsoft/Windows 11 Version 24H2 10.0.26100.0 - 10.0.26100.7623

Microsoft/Windows 11 Version 25H2 10.0.26200.0 - 10.0.26200.7623

Microsoft/Windows Server 2025 10.0.26100.0 - 10.0.26100.32230

Microsoft/Windows Server 2025 (Server Core installation) 10.0.26100.0 - 10.0.26100.32230

microsoft/windows_11_24h2 < 10.0.26100.7623

microsoft/windows_11_25h2 < 10.0.26200.7623

microsoft/windows_server_2025 < 10.0.26100.32230

Published Jan 13, 2026

Tracked Since Feb 18, 2026